Control Sequence Ranking for Critical System Based on Health of Equipment Thanks to Choquet Integral

This paper presents a ranking method of operating sequences based on the actual condition of complex systems. This objective is achieved using the health checkup concept and the multiattribute utility theory. Our contribution is the proposal of sequences ranking process using data and experts’ judgments. The ranking results in a decision-making element; it allows experts to have an objective and concise overall ranking to be used for decision making. A case study is presented based on an experimental platform; it allows us to compare two aggregation operators: the weighted mean and the Choquet integral.


INTRODUCTION
In the industrial field, system operating has become increasingly complex. This complexity arises from the following (Zio, 2009): • The increasing complexity of controlled systems (dimension, equipment number and heterogeneity, complexity of control, cohabitation of manual and automated equipment, etc.). • The difficulty to have a complete view of the system, i.e., mental representation by the plant operators. • The increase of imposed constraints (e.g., safety and environmental standards) and induced constraints (e.g., societal). • The difficulty for the operators and decision makers to take into consideration all the previous points as a whole.
With the growing consideration to economic, social, and environmental stakes, the safety of critical systems is at the heart of the concerns of specialists, government, and society. As such, it leads to becoming a major issue for both theoretical and applied research. According to the standard (ISO 13849-1:2015 (en)), security can be defined as the ability of an entity to prevent the occurrence, in given conditions, of critical or disastrous events. Therefore, when operating the system, it must be kept in a state in which the risk of human or material damage is limited to an acceptable level. Safety critical systems receive a particular attention since they represent a significant risk at the society level (Devaraj et al., 2020;Kumar et al., 2020;Maurya and Kumar, 2020). Safety critical systems emerge from the interaction of three poles (Tarride, 2013): • A complex technical system characterized by several interactions between its subsystems/components with physical couplings and feedbacks. • Human operators interacting with the system, in a given environment, with a synthetic vision influenced by several factors (rules, norms, etc.). • An environment in which the above two elements evolve and are influenced by.
Despite automation, complex system operating is largely based on human knowledge. This knowledge must consider the interaction of the complex system with its environment as shown in Figure 1. The system is decomposed into subsystems providing a set of functions down to equipment supporting the operation. A successful operating allows the complex system to perform its missions efficiently.
Usually, complex systems require the anticipation of the addressed mission by preparing and defining the operating sequences to be applied, i.e., the sequence of actions to be performed to fulfill the current mission. Such definition has to consider the suitable operating sequences that fulfill the requirement of system security and/or equipment availability. Nevertheless, such task is hardened by the use of huge amount of equipment for other production missions, for safety/maintenance and environment reasons leading to having several possibilities of equipment combination that allow the mission success. Hence, the operating sequence definition is carried out thanks to sequence generating methods at the design stage. Sequence generating methods use a model of the system in order to explore all the possible combinations of equipment state, that will lead to the success of the mission. Once the set of successful sequences is obtained, few of them, considered as the best choice with respect to expert knowledge, are selected and will be used to drive the complex system once in operation. However, in the sequence generation models, the state of the system and its equipment is binary, i.e., ON/OFF. While a sequence can be the best choice when its equipment is fully operating, it may not be the best once equipment is degrading. Furthermore, once in operation, among the set of suitable sequences, the experts must choose the best fitted one based on its knowledge, the actual conditions of the system, etc. Obviously, human experts cannot fully handle the consideration of tens, perhaps few hundreds, of equipment in a sequence neither the gradual performance drift due to equipment degradation. Hence, the motivation of this paper is to propose a ranking of operating sequences from the set of suitable sequences, according to the current state of the system, i.e., health of equipment, with respect to expert's knowledge.
This paper is organized as follows: sections 2 and 3 are devoted respectively to the study context presentation, the objectives, and the problem statement. Section 4 proposes to introduce the ranking process. Section 5 presents an application of the proposed approach on a case study. Conclusion and perspectives finish this article. model, a property is verified (Schnoebelen et al., 1999;Frey and Litz, 2000;Machado et al., 2006;Lahtinen et al., 2012;Goubali et al., 2016;Gouyon et al., 2020), or synthesis where the model respecting the constraints is obtained by calculation (Wonham and Ramadge, 1987;Ramadge and Wonham, 1989;Yeh and Chang, 2012;Zaytoon and Riera, 2017). How to obtain this set of sequences is not the subject of this paper. Here, we consider that this set contains only the sequence respecting dependability.
In this part, we present the ranking approach to integrate additional information for the sequence selection. While defining a mission, the expert must choose a particular operating sequence to perform from several acceptable sequences. This selection is based on the following: • Explicit knowledge: taken into account in the generation of acceptable sequences. • Implicit knowledge: for example, the decision criteria defined by the expert. • Synthetic knowledge: the representation of complex system by the expert. Indeed, the representation level of expert information is not the same as the sequence actions. • Incorrect knowledge: e.g., the plant representation by the expert can be false when the degradation compensation exists. • Subjective knowledge: e.g., two experts can select two different sequences.
Therefore, the approach proposed in this paper aims to help the expert in the selection based on the actual system state. The objective is, firstly, to provide to the expert a ranking of operating sequences based on a set of objective and concise overall information ( Figure 2) and, secondly, to make explicit the sequence selection by the following: • The definition of the decision criteria.
• The definition of the decision "rules." • The definition of actual system state.
Our work is original because the approach integrates the following: • The equipment characteristics (heterogeneity, number, criticity, etc.). • The operational context in the definition of decision criteria (time, cost, performance, solicitation, etc.). • The actual equipment conditions (health monitoring).

PROBLEM STATEMENT
A sequence selection making consists of a ranking of the suitable operating sequences in order to aid the expert. This ranking must take into account the complexity of system operating. This process is based on the system representation through sequences properties and system health state. So, we use the framework of the multicriteria decision making and more specifically the multiattribute utility theory (MAUT). The health checkup provides the current complex state of the equipment of a system in the form of several indicators. These indicators are mapped, thanks to utility functions, on a commensurable scale allowing them to be aggregated. This section presents the concept of system health checkup and introduces the theory of multiattribute utility.

Health Checkup Concept
Health monitoring aims at following the current state of a system (Kalgren et al., 2006;Omri et al., 2020). The objective of this process is to obtain a representation of the system state and to provide an assessment of its condition/health (Racoceanu, 2006) including incipient degradation. The sensors data are collected to be transformed into indicators, e.g., degradation indicators showing normal or abnormal operating mode of the system according to a reference (Ribot, 2009;Bouaziz et al., 2013).
The concept of equipment health checkup has been addressed in the literature. Byington et al. (2004) indicate that the health checkup corresponds to the actual level of deviations compared to a normal state. Liu (2007) refers by the health of system/ equipment its capability to perform the defined and expected function; therefore, health can be considered as the degree of required performance. Shin (2009) indicates that the performance of product/component is measured throughout its period of use, compared to design specifications, by the characterization of this performance degradation over time. Also, Kumar and Pecht (2010) refer to the fact that the context should be integrated within the parameters of health monitoring. Thus, the health vision is a complex concept reflecting functional aspect, dysfunctional aspect, and environmental aspect (Laloix, 2018;Dinh et al., 2020). Abichou (2013) has proposed a generic representation of these aspects from a systemic representation in the form of health checkup later completed by Laloix (2018) (Figure 3). A health checkup is a set of three classes of indicators: • Functional (or performance) indicators: they monitor the function performed by the addressed component at all levels of the hierarchical structure of the system. These indicators are mainly focused on the representation of the function flows (material, energy, and information) and the function performances. We find in this second category in particular i) effectiveness indicators (ratio between results/objectives) and ii) efficiency indicators (ratio between results/ resources). • Dysfunctional indicators: they are mainly related to the degradation mechanisms evolution. They can represent i) the degradation mechanism (e.g., leak, wear), where indicators are constructed from physical parameters, ii) the observable symptoms (e.g., vibration, temperature increase) and iii) the external degradation factors (e.g., system shocks, mechanical constraints). • Environmental indicators: these contextual indicators allow assessing the values taken by functional/dysfunctional indicators in relation to the conditions in which the system evolves. Hence, drift of functional/dysfunctional indicators can be put aside if resulting from operational and environmental conditions change and considered otherwise.
The health checkup formalization of an component E is given by Abichou (2013): where v(E) is the set of indicators for a system component E, I j is the jth indicator of performance (I p j ), degradation (I D j ), or environment (I E j ), and np E , resp. nd E and nen E , stands for the number of performance, resp. degradation and environmental, indicators assigned to E.
Prognostics and Health Management approach (PHM) aims at providing support to a system including the monitoring of its real state, the detection of incipient fault, and prediction of impending degradation of a system during its life-cycle (Kalgren et al., 2006). It relies on some important processes such as data processing, diagnostics, prognostics, and decision aiding. Figure 4 presents a typical architecture of PHM and shows the links that exist between these steps and the health checkup. Note that this generic architecture can be adapted to the application needs. The first step involves extracting relevant indicators from a qualitative and quantitative data processing. These indicators can be used for diagnostics to detect, identify, and localize abnormalities; also they can be used for prognostics to estimate the fault evolution. Finally, the decision support step allows choosing an appropriate action plan by evaluating predefined criteria (cost, yield, etc.) (Ben-Daya et al., 2009).
In our work, we are particularly interested in the concept of decision aiding and our study is oriented toward methods and tools from the field of Multicriteria Decision Aiding (MCDA).

Multiattribute Utility Theory
The problem of sequence ranking is a multicriteria decision problem. For Grabisch and Perny (2007), the performance of each alternative has to be evaluated according to the relevant aspects of the problem; then a classification can be performed following their performances. So, it becomes a comparison problem since the alternatives must be compared 2 to 2 in order to obtain a complete ranking. This comparison is based on the alternative's representation through criteria values according to the relevant aspects of the problem (Zopounidis and Doumpos, 2002). The difficulty lies in antinomic criteria that vary in opposite way. One classic example is the choice of a car according to its speed and its fuel consumption. Several multicriteria decision-making approaches exist. Among them, the most used are (Öztürk et al., 2005): PROMETHEE (Preference Ranking Organization Method for Enrichment Evaluations) (Mousavi and Lin, 2020), ELECTRE (ELimination Et Choix Traduisant la REalité, i.e,. elimination and choice expressing reality) (Mishra et al., 2020), AHP (Analytic Hierarchy Process) (Kubler at al., 2016;Liu et al., 2020), ANP (Analytic Network Process) (Chen et al., 2019), and MAUT (Multiattribute Utility Theory) (Dyer, 2005).
Recall that the objective is to classify a set of alternatives (sequences) on the basis of a multicriteria analysis. We use the framework of the MAUT theory, which is one of the most commonly used methods for decision support. We chose MAUT because we believe that taking into account the interaction between criteria is a necessary property in this type of application and a class of operators used in MAUT allows this. In the other methods mentioned above, only ANP and PROMETHEE allow this consideration. However, ANP is very complex to implement and PROMETHEE belongs to a set of methods whose properties are not compatible with our application.
So, according to the MAUT, the problem is formalized as follows. We aim to build a function f , such as: where adb is a binary predicate such as adb 1 if a is preferred or indifferent to b. K is the number of decision criteria; a 1 , . . . , a K and b 1 , . . . , b K represent the decision criteria values for each alternative a and b. d is usually given by an expert as a choice between the two alternatives.
The function f requires the use of aggregation (ψ) and ranking (ϕ) processes. The construction of f can be done by "aggregate and compare" approach or "compare and aggregate" approach (Grabisch and Perny, 2007). The second approach is well fitted when quantitative and qualitative criteria have to be combined or when criteria cannot be mapped to a commensurable scale. Despite these advantages, the "compare and aggregate" approach suffers some limitations (Arrow, 1951;Perny, 1992;Sen, 1986), among which is the loss of transitivity property or the existence of a subset of decisionary criteria. Indeed, Arrow's theorem (Arrow, 1951) shows that "compare and aggregate" approaches cannot respect, at the same time, the four following conditions for the set of criteria: universality, unanimity, binary independence, and nondictator.
Since our application requires the respect of the four conditions, the former approach has been preferred. The "aggregate and compare" approach also suffers limitations. Among them, Grabisch and Perny (2007) point out 1) the necessity to map the criteria on a common commensurable scale, 2) the conflicts between criteria and possible compensation, and 3) the amount of information requested to set the parameters of the models. Drawbacks 1) and 3) can be overcome since we have expert knowledge as well as operational data in order to provide sufficient information. Limitation 2) remains and cannot be overcome in the "aggregate and compare" approach. It classically happens when using a mean operator. But, using aggregation operator able to capture interaction between criteria allows mitigating this limitation. Nevertheless, such issue is of first importance when dealing with critical systems. Hence, the proposed approach aims at proposing a sequence ranking. The final decision to choose a particular sequence to be operated will remain in the hands of the system operator. The system operator will be able to balance between conflicting criteria and possible compensation. The proposed tool will help him to discard inadequate sequence when considering a huge number of equipment actions to be applied.
The formalization of this approach requires finding a numerical representation of preference, i.e., a function c : X → R, called score, such as: If d is a complete and transitive binary relation, then c can be written as: where u i : i → (1, K) are functions of X i → [0, 1] called marginal utility functions and ψ is an aggregation function (Dimuro at al., 2020). Note that the scale [0 1] is used for utility functions, although in the general case they are defined on R. The u ′ i s allow the expert to express the acceptable or not acceptable values; utility functions are used to ensure the following: • A common semantic for decision criteria: the criteria are heterogeneous; for aggregation it is necessary to have the same semantic. It corresponds to a score or satisfaction degree. • A common scale and commensurability hypothesis: the commensurability ensures that the same utility level, on two different criteria, corresponds to the same satisfaction intensity.
A consequence of formulation of Eq. (4) is that all elements are comparable. This property may not stand. Indeed, some situations may be not comparable according to expert's preference, i.e., neither adb nor bda stands. We assume that, for any pair of sequences a and b, the expert is able to compare them and give his preference (adb or bda). In that sense, u i and ψ reflect the expert preferences. The aggregation function ψ allows aggregating marginal utilities into a concise overall utility. In order for Eq. 4 to be satisfied, ψ must be idempotent: ψ must reflect the preferences of the expert while considering the criteria. Thus, it is desirable that ψ shall reflect the following (Grabisch and Perny, 2007): • the relative importance between criteria, • the tolerant or intolerant attitudes regarding some criteria, • the interactions between criteria Finally, from Eq. 4, the sequence ranking turns into finding the functions u i and ψ.

From Health Checkup to Multicriteria Decision
In this paper, we use the health checkup concept associated with the equipment of operating sequences in combination with MAUT. We propose to order these sequences (Seq i ) thanks to an aggregation operator that merges some indicators and properties of a sequence into single values that can be ordered. As mentioned in the previous section, the ranking process up to the decision is performed through four steps (see Figure 5). Through these steps, information from health checkup of equipment and sequence properties is transformed toward decision. We present in Figure 5 the information considered along this way. We describe the several information of Figure 6 starting from decision and going to real object properties.
The global score calculation is based on decisional objects described by a set of commensurable and semantically consistent criteria. These criteria are represented by utility functions (see Eq. 4). Hence for a particular sequence, Seq i , Eq. 4 becomes: To get the K utilities u k ∈ [1...K] , it is necessary to have an informational representation of the equipment. Hence, this informational representation quantifies decision criteria (cd k ) on appropriate utility scales: The criteria are developed from properties of real objects as the properties of a sequence P(Seq i ), or the equipment health checkup indicators v(eq j ): with eq j ∈ E(Seq i ) and E(Seq i ) the equipment set addressed in Seq i . The last phases of the ranking process, i.e., Eq. 6 and Eq. 7, rely to the classical mathematical framework of MAUT. However, for the first step of quantification, i.e., Eq. 8, the sequence and equipment heterogeneity have to be tackled. In the next part, we present the steps of the ranking process.

DESCRIPTION OF THE RANKING PROCESS
The ranking process of operating sequences is divided into four steps ( Figure 6): • To quantify: a quantification model establishes the link between the sequence properties, health checkup indicators, and decision criteria. • To calculate: the decision criteria are mapped into utilities u i according to expert's knowledge. • To aggregate: an aggregation operator ψ computes a global score for each sequence. • To order: a ranking operator ϕ to classify all sequences.
Before detailing these steps, some assumptions are required: • The input operating sequences that belongs to the set of suitable regarding safety aspects. • All the input sequences perform the same mission (objective). • All the equipment of sequence contributes to the achievement of the mission. • The properties and health checkup indicators are available.

Decision Criteria Quantification
In the general case, quantification maps the operating sequences and equipment condition into decision criteria. The list of criteria is determined from experts' judgment, in order to identify the main elements taken into account by the expert in his sequence selection (for example, time, cost, and performance indications). For each decision criterion, a mathematical function is calculated to combine the sequence properties and/or the equipment health checkup indicators of a sequence. A key point is to make the quantification step generic enough to be implemented for every operating sequence. Indeed, the sequences may have different number of actions with different components. The output of this step is the values of the N decision criteria.

Utilities Calculation
A utility function represents the relation between numerical values of the criteria (for example, cost values) and a utility referential from zero (for rejected values) to one (for preferred values). These functions can be obtained by learning from historical data or from experts' knowledge (Grabisch, 2006). As we use expert's knowledge, the second approach is chosen to define the N utility functions.

Aggregation
The aggregation mechanism merges information in a global value. In the general case, the aggregate score contributes to decision making from situations that may be contradictory. The aggregation operator ψ (see Eq. 5) associates a score with each sequence from the utility of the criteria. There are four main classes of aggregation operators (Beliakov et al., 2007): conjunctive, disjunctive, compromise, and hybrids. However, only compromise aggregation operators respect the idempotent property (see Eq. 5). The main compromise operators are arithmetic mean, weighted arithmetic mean, ordered weighted averaging, and fuzzy integral. This last family of aggregation operators takes into account interaction between criteria (Grabisch and Perny, 2007).
Aggregation allows synthesizing the utility values of the criteria in a global score. The choice of an aggregation operator depends on the application (Grabisch et al., 2011). For our application, we decide to compare the calculation results with two compromise operators: weighted arithmetic mean (WA) and the Choquet integral (CI). On one hand, WA operator has been selected since it is a standard operator known by everybody thanks to its widespread use and simplicity. Nevertheless, it cannot be used to model wide spectrum of decision maker preferences since it has intrinsic limitation (Grabish and Labreuche, 2010). On the other hand, CI operator is far less known but has given very good result in several domains and also from a theoretical point of view given raise to several extension (Dimuro at al., 2020). Furthermore, contrary to many aggregation operators, CI is able to handle interactions between criteria and is the only one, in its basic form, to handle homogeneous and heterogeneous interrelationships (Sun et al., 2018). Such interaction should be understood not as correlation between entries but as modeling the dependencies between the criteria thanks to the preference of the decision maker (Marichal, 2000a).
The WA operator associates a different weight with each criterion, and the sum of these weights is equal to 1. The formulation of the WA is given by: The CI operator uses parameters which reflect the criteria weights and the interaction degree between these criteria. These parameters are represented in the form of capacity (or fuzzy measures) (Marichal, 2000b). The CI is defined by Murofushi and Sugeno (1991) as: where x (1) , . . . , x (n) represents the normalized values of the criterion, where (.) is a permutation operator such that represents the importance degree of the set A4X in the computation of the global value X. An analysis of the capacity can be carried out using the Shapley importance index and the interaction index (Marichal, 2000a). Shapley index takes into account the mean importance of a criterion in relation with its contributions for all capacity. In a similar manner, the interaction index quantifies the interaction between two criteria on all capacity.

Ranking
The last step of the ranking process aims at classifying the scores γ from the best to the lowest. Since the aggregation computes the scores γ on R, the comparison operator ≥ is used to classify them (see Eq. 3). This aspect must reflect the ranking represented by the preference relation d. The result is an element of decision making for the definition of the operating sequence.

CASE STUDY: APPLICATION TO CISPI A CRITICAL SUBSYSTEM
Among Safety Critical Systems (SCS) (Diaz et al., 2020;Wang et al., 2017), we are interested in those related to the chemical or nuclear industry. In these industries, the problem of piloting amounts to choosing the best lineage according to several criteria of different natures. CISPI, a research platform of the CRAN (Centre de recherche en automatique de Nancy) scales down a subsystem of a power genetor plant. Figure 7 shows the operating subsystem which controls the liquid flow through the C k , C p , and C s tanks. Note that the objective mission is to fill the storage tank C s . This circuit is composed of 1) three routes: R 1 , R 2 ,and R 3 between the C p and the C s tanks, 2) two linear valves VR 1 and VR 3 to control the flow of R 1 and R 3 , 3) solenoid valve VE 2 to control the R 2 flow, and 4) four manual valves VM 1 , VM 2 , VV 2 , and VM 3 . To ensure a sufficient level of liquid in the C p tank, two additional routes are solicited R 4 and R 5 . From an external input source, R 4 allows filling the tank C p through a pump PO, two solenoid valves VE 41 , VE 42 , and two manual valves VM 41 and VM 42 . A relief valve Rv limits the internal pressure of R 4 in order to protect equipment. R 5 ensures the same mission as R 4 ; it is associated with a storage tank C k and controlled by two manual valves VM 51 and VM 52 . Finally, CISPI is instrumented through pressure sensors PI and flow sensors FI.
For the CISPI installation (Figure 7), the elementary lineages are as follows (Clanché et al., 2010): • Lineage N°1: filling up with Cp tank and input source (R4 and R1/2/3) • Lineage N°2: filling up with Cp and C k tanks (R5 and R1/ 2/3) • Lineage N°3: filling up with C p , C k tanks and input source (R 4/5 and R 1/2/3 ) When performing a sequence, the system operator must handle several equipment and move between manual equipment with estimated execution times ET p ( Table 1).
For the two routes of the subsystem, three sequences are defined for the target mission as follows: • Seq 1 : ┴VM1 ┴VR1 (R1) • Seq 2 : ┬VM2 ┴VV2 ┴VE2 (R2) • Seq 3 : ┴VM1 ┴VR1 ┬VM2 ┴VV2 ┴VE2 (R1 and R2) where ┴ and ┬ stand for the valve opening and closing actions. First of all, the criteria of Table 2 are considered. Note that each decision criterion combines the properties of the operating sequence and the health checkup of equipment. For example, Figure 8 shows respectively the execution time (in time unit UdT) and the pipe length (in length unit LU).
Each sequence is characterized by a set of properties associated with the actions (manual/automatic) and the direct equipment (as valve, pump) or the structure equipment (as tanks and pipes).
In the proposed model, the equipment actual condition is taken into account, by health checkup v(eq i ) concept. As defined above, the equipment health checkup includes three classes of indicators: functional, dysfunctional, and environmental. The v(eq i ) indicators for VM i , T x , and C x are summarized in Table 3. These indicators are defined by the available measurements and/or expert's knowledge.
For our academic example, we consider the following numerical value: Note that the initial state corresponds to the plan shutdown; this allows us to assume the initial state of the operated equipment when defining the sequences. For this critical system, we assume also that even if equipment was initially closed, closing action must be verified. From the three lineages presented above, 21 operating sequences are defined. These sequences are assumed qualified from safety point of view and optimal (i.e., no useless action). The set of acceptable sequences are described in Table 4. We use "Seq i " to refer to a specific sequence.
Each sequence refers to a route leading to a set of operated equipment, sensors, and structure equipment. This equipment is assessed by the health checkup indicators. Thus, the sequence properties and health check up indicators are the parameters to choose a sequence to be performed.

Decision Criteria Quantification
For this study, criteria were defined for the ranking. Each decision criterion cd takes as argument either the sequence properties or the sequence properties and the health check up indicators of the equipment as follows ( Table 4).
The time of the sequence achievement is calculated according to the opening/closing time (ET o and ET f ) of the equipment (eq j ) for actions (A i ), and execution time (ET P ) between manual equipment (eq M j ) starting from an initial position I 0 . cd 1 is given as follows: The second criterion takes into account the costs of manual and automatic actions (CAM j , CAA j ) and material costs CdM for given equipment eq j : with Seq i the number of actions in the sequence and CA j ∈ {CAM j , CAA j }. The third criterion is the percentage of automated actions in the sequence. This criterion depends on the number of automatic actions: with Seq i auto being the cardinality of automatic actions.
Finally, the fourth criterion is the performance of the task achievement. This criterion is based on the tanks volumes V MO , lineage volumes V Lg , nominal flows D n , and leak flows D f for all equipment. We assume that the initial levels are sufficient to achieve the mission: V Lg eq j , eq j+1 D n eq j + | Seq i| j 0 D f eq j ≈ V MO eq j |Ln| l 1 D n Eq j +   with (L d − L s ). Scs Lp.Scp ≤ 1, (S i , L i ) being the surfaces and the levels of C p and C s tanks. L d is the desired level. In addition, the volume V MO is much higher than the volumes in the various equipment |Seqi| j 0 V Lg (eq j , eq j+1 ).
For each sequence, the value of each criterion must be calculated from the numerical values given. Obtaining the values of each criterion for the first sequence will be detailed, and the criteria values of the other two sequences will be given directly.

Utilities Calculation
The definition of utility functions will enable to map the criteria on a commensurable scale. Higher levels of utility are associated with the preferred values. Figure 9 shows the proposed functions.
The utility functions for each criterion are determined according to the following rule and considering the nominal state of the system. The minimum and maximum values of criteria are calculated considering all the operating sequences. The interval [0.2 1.0] is used for the utility of "nominal state" sequences. The use of these limit values is required since: • no criteria can have a better value (the system is designed to be the best solution in its nominal state); hence the maximum value of the utility, i.e., 1, is given to these values, • criteria may have worth values since when degrading, equipment may work in nonoptimal state but still good for the system operation. Hence, some nonzero utility values must be affected by these. That is why we use 0.2 utility value for the worth criteria values in order to calculate decision criteria with equipment health variations.
When operating in degraded scenario, criteria will take utility value of 0 showing not acceptable values.

Aggregation
The parameters of the aggregation operator have to be identified. A subset of sequences {Seq 7 , Seq 3 , Seq 19 , Seq 12 , Seq 9 , Seq 2 , Seq 16 } is used for that purpose. The sequences of the subset are shown to an expert who has the following preferences:  Seq 7 _ Seq 3 _ Seq 19 _ Seq 12 _ Seq 9 _ Seq 2 _ Seq 16 .
With respect to his preferences, the expert gives each of them a global score. The set of alternatives and the expert's score are presented in Table 5.
The coefficients of the weighted arithmetic mean (WA) are calculated from the learning data provided by the expert, i.e. presented in Table 5. We resolve the system of equations A*W i B, where A is the alternatives matrix [u cd 1 , u cd 2 , u cd 3 , u cd 4 ] and B is score vector [score]. Table 6 gives the obtained W i coefficients.
Using the Kappalab extension of GNU-R software , the capacity is identified from the same learning data, i.e. Table 5. Figure 10 shows the Shapley values. Shapley's values give the importance of a criterion in relation to its contributions to overall capacity. For example, performance (cd 4 ) has the highest weight in relation to other criteria such as with WA. The second most important criterion, for the WA, is cd 2 : cost. Figure 11 presents the interaction indexes for the identified capacity of the CI. The interaction indices reflect the interaction between two criteria across the capacity. Thus, a positive value of the interaction between a pair of criteria (e.g., cd 1 , cd 3 ) corresponds to the configuration where when the utilities of cd 1 and cd 3 have a significant value, the CI result is greater than the result of the sum of the individual contributions. We then speak of synergy between the criteria. For a negative value of the interaction (e.g., cd 2 , cd 3 ), an opposite interpretation is done. We then speak of redundancy between the criteria. We notice a strong positive interaction between (cd 3 , cd 4 ), and a weaker interaction between (cd 1 , cd 2 ) and (cd 1 , cd 2 ). For the negative interactions, there are some between (cd 1 , cd 4 ), (cd 2 , cd 3 ), and (cd 2 , cd 4 ).

Ranking (on the learning set)
The obtained aggregation scores and sequences ranking for the weighted arithmetic mean (WA) and the Choquet integral (CI) operators are given in Table 7 for the learning subset of

Scenario and Discussion
After checking the ranking on the learning set, look at the results on the complete set of sequences. Indeed, once the CI and WA parameters are learned, we can generalize the ranking to the whole set of sequences, i.e., {Seq 1 , . . . , Seq 21 }. We also need to analyze the behavior of the ranking when the components will degrade, which is the main contribution of our proposal. Indeed, we compare the results of aggregation operators based on two "degradation" scenarios. Firstly, we consider a sequence with a slight deviation of equipment health indicators for the route R 1 . Secondly, we consider the larger deviation for the same route R 1 . Similarly, the expert proposes the same preferences for the ranking. Table 8 shows the scores and ranking of the whole set of sequences in nominal mode, i.e., without considering degradation of equipment. Both rankings exhibit different results. The CI operators show more gradualness of the scores over all sequences. On the contrary, for WA operator, there is a clear discrepancy between the scores of Seq 20 and Seq 1 ; this discrepancy is not found in the scores of the CI sequences. We also note, for both CI and WA, that some sequences have identical scores (e.g., 3 and 6, 15, and 18). Since R 1 and R 3 are identical, it is obvious that sequences, in which one is replaced by the other, obtain equal scores.

Scenario #1: Low Deviation of Health Indicators
For this first degradation scenario, we simulated a slight variation in the opening and closing times of the VM 1 manual equipment of the route R 1 . This degradation impacts only cd 1 . The new scores obtained for all the sequences are shown in Table 9.
We obtain globally the same behavior as for the nominal scenario. We can note some changes in the ranking which are     due to the fact that route R 1 and route R 3 are no longer equivalent. Thus, the scores obtained for the sequences using route R 1 have slightly decreased. This decrease is normal since R 1 equipment is degraded. The score must decrease. For example, for sequences Seq 3 and Seq 6 , the score for the CI in nominal state is the same, 0.7844. It remains the same for Seq 6 , since it does not include R 1 equipment, while Seq 3 score becomes 0.7823 since it does include R 1 equipment. The same behavior is observed for the WA. Thus, with a slight degradation, the order of the sequences slightly changes.

Scenario #2: Larger Deviation of Health Indicators
The second degradation scenario is intended to illustrate considering of a more serious degradation of the route R 1 . Thus, in addition to the first scenario degradation, we consider a leak at the level of the pipes T x of route R 1 . This scenario thus consists in simulating not only a drop in the performance of the manual valve but also the malfunctioning of the pipes. Hence this scenario impacts cd 1 and cd 4 . The new scores obtained for all the sequences are shown in Table 10. One can observe more significant changes in the order of the sequences. For instance, Seq 3 deacreases from rank #3 for the nominal scenario, to #4 for scenario 1 and #5 for scenario 2. The same is for Seq 15 which respectively to ranks #19, #20, and #21. The effect of the degradation on the overall score produces this decreasing in ranking. On the contrary, Seq 7 in the three scenarios remains ranked #1. Indeed, the difference of score with the second-best sequence was big enough to compensate the decreasing due to degradation. Moreover, thanks to other sequence score changes, Seq 6 , whose score did not change, is now ranked #2 while it was ranked #3 with Seq 3 in nominal scenario and was ranked #3 alone in scenario 1.
We also notice that, for the sequences with the lowest scores, i.e., the last eight sequences, the order is completely changed. The impact of a degradation is more important on the scores when they are low. The same behavior is also observed for the WA.
Finally, Table 11 presents the scores of the sequences whose scores changed due to scenario 1 and scenario 2 degradation. We compute some statistics as well on these scores. First the CI operator gives a wider range to the scores than WA and both maximum and minimum values are over and above those of WA for all scenarios. The mean of the IC is lower than the mean of WA while for the standard deviation, the reverse is true. From these statistics, we can conclude that the scores of the IC are more grouped than those of WA while the queue of the cluster, i.e., extreme values, is further for the IC than for WA.

CONCLUSION
This paper dealt with the problem of ranking operating sequences of a complex system. Indeed, operating sequence selection is performed using sequence generating method that does not consider the real state of the equipment. Such approaches are performed during the design phase of the critical system and lead to a set of few sequences to use during the operational phase. When a sequence has to be applied, one is selected among these few sequences thanks to the operating crew. The main drawback of such approach is mainly twofold. First, some sequences are ignored since they are discarded at the design phase. Second, humans can hardly consider tens, perhaps few hundreds, of equipment in a sequence neither the gradual performance drift due to equipment degradation. Both may lead to not selecting the optimal sequence to be applied. To overcome such issue, we propose an approach leveraging multiattribute utility theory with equipment health checkup. The main advantage of such approach is that it enables at the operating stage considering all the success sequences as well as all the equipment health in an objective way. In order to illustrate the performance of adopted tools, a case study is presented on the CISPI experimental platform. This study presents the aggregation results obtained by the Choquet integral operator that allow ranking the operating sequences according to the expert's preferences. This ranking is provided for different operating modes (nominal, deviation, and degradation) corresponding to different equipment health indicators. Our proposed approach has several advantages and shows potentialities in a complex industrial context. It allows also the formalization of knowledge and provides concise and overall information to expert. Moreover, this approach takes into consideration the heterogeneity, number, importance, solicitation, and actual condition of equipment in the decision making.
Future works will focus firstly on a comparative study between the results of the two methods presented in this paper and the ordered weighted averaging operator OWA (Filev and Yager, 1998). Beyond this comparison, the hierarchical aspect of health checkup should be integrated. Indeed, for complex systems, the health concept must be present at different abstraction levels and must reflect the existing relationships between these levels. Thirdly, we will apply this approach to other case studies (e.g., chemical complex processes) by considering several criteria associated with the system context with a more representative utility function. In addition, the utility functions learning aspect should be analyzed especially in the case of uncertain information.

DATA AVAILABILITY STATEMENT
The datasets generated for this study are available on request to the corresponding author.

AUTHOR CONTRIBUTIONS
M-FB was engineer and performed the application. PM provided the background and theoretical contribution on complex critical system sequence elicitation. AV provided the background and theoretical contribution on multicriteria decision making and Choquet integral. J-FP was coordinator of the project and supervised the work.